sloth-d2c-mcp@1.0.6-beta.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sloth-d2c-mcp@1.0.6-beta.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/build/plugin/loader.jsView file

1import { execSync } from 'child_process'; L2: import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

cli/run.jsView file

141stdio: 'ignore', L142: shell: true, // 需要 shell 来解析命令 L143: windowsHide: true, // 隐藏windows下的命令行窗口

High

Shell

Package source references shell execution.

cli/run.jsView on unpkg · L141

348const installCmd = packageManager === 'pnpm' L349: ? 'pnpm install -g sloth-d2c-mcp --registry=https://registry.npmjs.org/' L350: : 'npm install -g sloth-d2c-mcp --registry=https://registry.npmjs.org/'; ... L352: try { L353: const result = spawnSync(installCmd, { L354: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/run.jsView on unpkg · L348

dist/build/server.jsView file

778try { L779: selectionModule = await import(moduleUrl); L780: break;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build/server.jsView on unpkg · L778

dist/build/utils/tj.jsView file

1import * as os from 'os'; L2: import axios from 'axios'; L3: import pkg from 'node-machine-id'; ... L8: */ L9: const isOnline = process.env.NODE_ENV === 'production'; L10: let lastEvent = ''; ... L25: osVersion: os.release(), L26: hostname: os.hostname(), L27: nodeVersion: process.version, ... L52: axios L53: .post('https://otheve.beacon.qq.com/analytics/v2_upload?appkey=0WEB0IK7H05E5K4S', { L54: appVersion: '',

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/build/utils/tj.jsView on unpkg · L1

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/build/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-mcp@1.0.5-beta46 matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.5-beta46 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/build/index.jsView on unpkg

Source & flagged code

7 flagged

dist/build/plugin/loader.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

3import * as path from 'path';

4import { fileURLToPath } from 'url';

5import envPaths from 'env-paths';

6import { PLUGIN_HOOKS } from './types.js';

7import { createRequire } from 'module';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10// 检测是否存在 pnpm

11function hasPnpm() {

12 try {

13 execSync('pnpm --version', { stdio: 'ignore' });

14 return true;

15 }

16 catch {

17 return false;

18 }

19}

20// 获取包管理器命令

21function getPackageManager() {

cli/run.jsView file

Lines 121-161javascript

121 const path = await import('node:path');

122

123 // // 获取当前脚本路径（兼容 Node.js 18）

124 const scriptPath = fileURLToPath

dist/build/server.jsView file

Lines 758-798javascript

758 window.parent.postMessage(

759 {

760 type: 'sloth-d2c:implementation-toolbar-action',

761 payload: {

762 groupIndex,

763 buttonIndex,

764 },

765 },

766 '*',

dist/build/utils/tj.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import axios from 'axios';

3import pkg from 'node-machine-id';

4import { Logger } from

package.jsonView file

Lines 73-103json

73 "react-hot-loader": "~4.13.0",

74 "react-inspector": "~6.0.2",

75 "reflect-metadata": "^0.2.0",

76 "rxjs": "^7.8.1",

77 "sloth-d2c-figma-plugin":

dist/build/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-mcp@1.0.5-beta46 matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.5-beta46 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/build/index.jsView on unpkg